Archive

sinkhole policy

Explorer

I would like to use the sinkwhole policy to tell splunk to index a folder.
Please see below. I need to send these lgos to a seperate index. How can I define the index here to be sent? Whats the syntax.
Also if I append the below to the input.conf is it correct? There are some other stanzas in the input.conf already.

In $SPLUNKHOME/etc/system/local/inputs.conf
[batch://YOURPATHHERE]
move
policy = sinkhole
host=HHHH
followSymlink = false

Tags (1)
0 Karma

Legend

This should do it -

[batch://YOURPATHHERE]
move_policy = sinkhole
host=HHHH
followSymlink = false
index=XXXXXX

Where XXXXXX is the name of the index where you want to send the data

0 Karma

Explorer

can you confirm other part of my question. in the input.conf. can i just append this ?

0 Karma